Steganography is the practice of hiding a message inside something that does not look like a message. Encryption makes data unreadable; steganography makes it invisible, which is a different problem and often a more useful one for an attacker. This guide covers the four ways data actually gets hidden in files, how attackers have used those techniques in real campaigns, and the six-command workflow that finds hidden payloads. Work through it alongside HackerDNA's Steganography course, which walks the same techniques with files you can pull apart yourself.
If you have solved a capture the flag challenge before, you have probably met steganography under the forensics banner. Our guide to CTF categories explains where it sits alongside crypto and reversing. What follows goes deeper into the actual file mechanics.
TL;DR: Steganography hides data inside a carrier file so nobody suspects there is data to look for. The four techniques that cover almost everything you will encounter are metadata fields, bytes appended after the end of a file, least significant bit encoding in pixels or audio samples, and invisible characters in text. Detection is a fixed workflow: file, exiftool, binwalk, strings, zsteg, then a passphrase attack with stegseek.
What Is Steganography?
Steganography is the technique of concealing information inside an ordinary-looking file, message or physical object so that the existence of the information stays secret. The carrier looks and works exactly as expected: the image still opens, the audio still plays, the document still reads normally.
That last sentence is the whole point, and it is what separates steganography from cryptography. An encrypted file announces itself. Anyone who intercepts it knows a secret exists, even if they cannot read it, and in some countries that is enough to compel you to hand over a key. A stego file makes no announcement at all. The two techniques stack well: encrypt first, then hide the ciphertext, and an investigator who somehow finds the payload still has nothing to read.
The idea is old. Herodotus records Histiaeus shaving a slave's head, tattooing a message on the scalp, and waiting for the hair to grow back before sending him. German agents in the Second World War shrank pages of text to microdots the size of a typed full stop and glued them over punctuation in ordinary letters. The physics changed when files replaced paper; the logic did not.
Three terms show up constantly and are worth pinning down before the technical sections:
- Carrier (or cover file) - the innocent file doing the hiding. A holiday photo, a WAV recording, a PDF invoice.
- Payload - the data being hidden. Often a text file or a key, sometimes an entire executable.
- Stego file - the result. Carrier plus payload, still a valid file of its original type.
How Data Actually Gets Hidden in a File
Four families of technique cover the overwhelming majority of what you will meet, in CTFs and in real incidents. They are listed here roughly in order of how easy they are to find, which is also the order you should test in.
1. Metadata fields
Every JPEG, PNG and MP3 carries structured metadata: EXIF tags, XMP blocks, ID3 frames. Most of those fields are free text, and nothing validates what goes in them. A comment field holding a base64 blob is the laziest possible hiding place, and it still shows up regularly because it survives file transfers and needs no special tooling to create.
2. Appended data
Image formats declare where they end. A JPEG finishes at the FFD9 end-of-image marker, a PNG at the IEND chunk. Every byte after that marker is ignored by image viewers and preserved by file systems. Concatenate a ZIP archive onto a PNG and you get a file that opens as a picture in one program and unzips as an archive in another. That trick, called a polyglot, is why cat photo.png secret.zip > output.png is one of the first commands anyone learns.
3. Least significant bit encoding
This is the technique people mean when they say steganography without qualifying it. In a 24-bit image, each pixel stores three colour channels of eight bits each. Change the last bit of a channel and the colour shifts by 1 part in 256, which no eye detects. Use one bit per channel across a 1920x1080 image and you have 6,220,800 bits of space, or roughly 759 KB of payload inside a file that looks untouched.
The same arithmetic works on audio samples and video frames. The cost is fragility: LSB data does not survive re-encoding. Upload an LSB-carrying PNG to a platform that recompresses images and the payload is gone, which is exactly why attackers who use this technique host their images on services that serve files back byte for byte.
4. Text and whitespace encoding
Text has no pixels to modify, so it hides data in the parts nobody renders: trailing spaces, tab-versus-space patterns, and Unicode characters with no visual width at all. Zero-width space (U+200B), zero-width non-joiner (U+200C) and zero-width joiner (U+200D) are legitimate characters that browsers dutifully pass through and display as nothing. Two of them encode binary directly.
Steganography in Cyber Security: How Attackers Use It
Steganography is catalogued by MITRE as T1027.003, a sub-technique of Obfuscated Files or Information. The framework's own procedure examples span fifteen years of tooling: Duqu encrypted collected system data and hid it inside an image before exfiltrating it, PowerDuke concealed backdoors in PNG files, IcedID embedded binaries in encrypted PNGs for distribution, and APT37 has distributed images carrying embedded shellcode.
The pattern that dominates current campaigns is simpler than any of those. A first-stage script downloads an image from an ordinary image host, pulls a base64-encoded payload out of it, and runs the result in memory. In a campaign analysed by ANY.RUN and reported in March 2025, an XWorm loader was hidden in an image at offset 000d3d80, marked with a literal <<BASE64_START>> string, and injected into AddInProcess32 by a VBS downloader.
Note what that offset marker tells you. The payload was not woven into pixel data with clever mathematics. It was pasted into the file with a text delimiter around it, because the goal was never to defeat a forensic analyst. The goal was to get past a mail gateway and an endpoint scanner, and most of those inspect executables, archives and scripts far more aggressively than they inspect a PNG.
That is the security lesson worth carrying out of this section. Steganography is rarely the interesting part of an attack chain. It is a delivery wrapper chosen because image files are trusted by default, and it works for exactly as long as that assumption holds in your monitoring stack.
How to Hide Data With Steghide
Steghide is the tool most tutorials reach for, and it is worth knowing precisely because it turns up so often in CTF challenges. Version 0.5.1 dates from 2003 and has not been updated since, which matters less than you would expect: the file formats it targets have not changed either.
Install it and embed a payload:
sudo apt install steghide
steghide embed -cf holiday.jpg -ef secret.txt -p hunter2Extraction is the mirror image:
$ steghide extract -sf holiday.jpg -p hunter2
wrote extracted data to "secret.txt".Two details from the steghide manual save real time. First, the cover file must be JPEG, BMP, WAV or AU. Steghide does not support PNG or GIF, so when someone hands you a PNG and suggests steghide, they have already told you it is the wrong tool. Second, the payload is encrypted before embedding, by default with Rijndael at a 128-bit key size in cipher block chaining mode. That means a correct passphrase is required, and a wrong one produces an error rather than garbage.
Ask what is embedded without extracting it:
$ steghide info holiday.jpg
"holiday.jpg":
format: jpeg
capacity: 3.1 KB
Try to get information about embedded data ? (y/n) y
Enter passphrase:Steghide also spreads its changes using a graph-theoretic matching algorithm rather than writing bits into consecutive pixels, so the colour frequency distribution of the image stays intact. That defeats first-order statistical tests, which is why generic LSB detectors stay quiet on steghide output and you need a tool built for the format.
How to Detect Steganography
How can steganography be detected? Run the file through a fixed sequence of checks that each target one hiding technique: identify the true file type, read the metadata, scan for appended files, pull printable strings, test the pixel bit planes, and finally attack the passphrase. Most hidden payloads surface in the first three steps.
Here is the workflow, in the order that finds things fastest:
- Confirm what the file really is.
file suspicious.pngcompares the magic bytes against the extension. A "PNG image data" result on something named.jpgis a finding on its own. - Read every metadata field.
exiftool -a -u suspicious.pngshows duplicated and unknown tags as well as the standard ones. Comment, Artist and Software fields are where lazy payloads live. - Look for appended files.
binwalk suspicious.pngscans for embedded file signatures anywhere in the byte stream. Binwalk 3 is a Rust rewrite of the old Python tool and is noticeably faster on large files. Add--extractonce it reports a hit. - Pull the printable strings.
strings -n 8 suspicious.png | grep -Ei 'flag|base64|BEGIN'catches base64 blobs and delimiter markers. This is the step that would have caught that XWorm loader in seconds. - Test the bit planes.
zsteg -a suspicious.pngtries every combination of channel, bit order and offset against PNG and BMP files. Extract a specific hit withzsteg -E '1b,rgb,lsb' suspicious.png > out.bin. It also recognises OpenStego and Camouflage output. - Attack the passphrase. For JPEG, BMP, WAV and AU files,
stegseek suspicious.jpg rockyou.txtbrute-forces steghide passphrases.
That last step deserves its own note, because it changes what is feasible. Stegseek runs through the whole of rockyou.txt in under two seconds on ordinary laptop hardware, a benchmark of roughly 14 million passwords in 1.21 seconds. The tools it replaced took hours to do the same work. If you learned steganography before 2021 and remember passphrase cracking as a last resort, it is now something you run while you are still reading the challenge description. The same wordlist logic applies here as in any other credential attack, which our hash cracking guide covers in depth.
In practice, the first four steps resolve most files, and the two that follow are for the ones that survive. When a PNG passes file, exiftool, binwalk and strings without a whisper, that silence is itself information: you are probably looking at LSB encoding or at nothing at all. Open it in Stegsolve and step through the colour planes. Genuine LSB payloads show up as visible noise or hard-edged shapes in a single bit plane, and you will recognise the difference on your third or fourth file.
One caution about detection tools that claim statistical certainty. Chi-square and RS analysis, the methods behind detectors like StegExpose, work well against naive sequential LSB embedding and poorly against anything that randomises placement using a passphrase-seeded generator. A clean statistical report is weak evidence of a clean file.
Text Steganography and Zero-Width Characters
Text steganography gets skipped in most guides because it feels like a novelty. It is the technique most likely to reach a real user, since it survives copy and paste, email clients and chat applications intact.
The method is straightforward. Encode the payload as binary, map 0 to a zero-width space and 1 to a zero-width non-joiner, then insert the resulting sequence between two visible characters. The message renders exactly as it did before. A 200-character secret becomes 1,600 invisible characters wedged into a blog post, and no reader sees a thing.
Detection is easier than hiding, once you know to look:
$ python3 -c "print([hex(ord(c)) for c in open('post.txt').read() if ord(c) > 0x2000])"
['0x200b', '0x200c', '0x200b', '0x200c', '0x200c']Any run of U+200B through U+200D in ordinary prose is deliberate. Legitimate uses exist, mainly for line-breaking in scripts without spaces, but they do not appear in dozens-long runs inside English text. Paste suspicious text into a hex viewer and the pattern is unmistakable.
This technique also underpins the invisible watermarking used to trace document leaks, where each recipient gets a copy carrying a different zero-width identifier. Same mechanism, defensive purpose. The Phantom Text lab hides a flag in zero-width characters inside an ordinary-looking blog post, which is the fastest way to build the instinct for spotting it.
Picking the Right Tool for the File in Front of You
Steganography wastes more CTF time than any other category, almost always because people run tools in the wrong order or against formats those tools never supported. This table is the short version of everything above.
| File type | Start with | Then try |
|---|---|---|
| PNG, BMP | zsteg -a | binwalk, Stegsolve bit planes |
| JPEG | stegseek with rockyou | exiftool, binwalk |
| WAV, MP3 | Audacity spectrogram view | steghide, strings |
| PDF, DOCX | binwalk --extract | exiftool, unzip the container |
| Plain text | Hex viewer for U+200B to U+200D | Whitespace pattern analysis |
The audio row surprises people. Load a WAV in Audacity, switch the track view to Spectrogram, and hidden messages written into specific frequency bands appear as readable text drawn across the display. No command line involved, and it takes about fifteen seconds. Several well-known CTF challenges have hidden nothing more elaborate than that.
Time limit worth keeping: if the full workflow produces nothing in ten minutes, the file is probably a decoy or the payload needs a key from another challenge. Move on and come back. Grinding a single image for an hour is the most common way to lose a CTF.
Frequently Asked Questions
Is steganography illegal?
No. Steganography is a technique, and hiding data in your own files is legal everywhere. What creates legal exposure is what you hide, whose files you hide it in, and where you move it afterwards. Concealing data to move it out of an organisation that has not authorised the transfer is a policy violation at minimum and a criminal one in many jurisdictions, whether or not steganography was involved.
What is the difference between steganography and cryptography?
Cryptography makes a message unreadable but visible; steganography makes it invisible but readable to anyone who finds it. An encrypted file tells an observer that a secret exists, while a stego file aims to prevent that question from being asked at all. Serious use combines both: encrypt the payload, then hide the ciphertext.
Can AI detect steganography?
Machine learning classifiers do outperform classical statistical tests such as chi-square and RS analysis on LSB detection, and research systems reach high accuracy on datasets built with known embedding tools. They generalise poorly to techniques they were not trained on, and neither approach reliably flags content-adaptive embedding. For practical work, deterministic checks with binwalk, zsteg and stegseek find more real payloads than any detector.
Can steganography survive social media uploads?
Usually not. Platforms that recompress or resize uploaded images destroy least significant bit payloads and strip most metadata, which is why LSB is a poor delivery channel through them. Appended data after the IEND or FFD9 marker survives on any service that stores files byte for byte, and that difference explains which hosting services keep showing up in malware campaigns.
Where can I practice steganography legally?
Use files built for it. HackerDNA's Steganography course covers metadata, appended data, LSB, steghide cracking, audio, text and polyglot files across ten guided chapters with challenge files included. CTF competitions and images you create yourself are equally safe. Never run extraction tools against files you obtained without permission.
Legal and Ethical Considerations
Critical reminder: only analyse files you own or have explicit written authorisation to examine. Extracting hidden data from someone else's images can constitute unauthorised access under the Computer Fraud and Abuse Act in the United States, the Computer Misuse Act in the United Kingdom, and equivalent laws elsewhere, regardless of how the file reached you.
Two situations come up often enough to plan for. If you find hidden data during an authorised engagement, stop and check your rules of engagement before extracting further. Payloads that turn out to contain personal data, credentials belonging to third parties, or illegal material create obligations that are far easier to handle before you have copied them to your workstation than after.
The second is on the defensive side. Steganography is a real exfiltration channel, and the countermeasure is not detection. It is transformation. Re-encoding every image at the gateway destroys LSB payloads without needing to identify them, and stripping metadata on upload removes the easiest hiding place entirely. Both are cheap, both are deterministic, and neither depends on a classifier being right.
Your Next Steps With Steganography
Steganography rewards pattern recognition more than tool knowledge. The command list is short and stable, and once file, exiftool, binwalk, strings, zsteg and stegseek are in your fingers, the skill that remains is reading a file and knowing which of the four hiding techniques you are looking at before you type anything. That comes from volume, not from reading.
Start with the Vigenere Stego Hunt lab, where you extract a key from an image and use it to break a classical cipher, because layered challenges are what real CTF steganography looks like. Then work through the Steganography course, which takes every technique in this guide across ten chapters with files to pull apart in each one. Everything runs in the browser, and the free tier needs no credit card.
